Get authentication token with Blazor Server and Azure AD authentication

Question

I have set up Azure AD authentication with a Blazor server app. It works. I get redirected to login after which I get returned to the app.

In Startup.cs:

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
    .AddAzureAD(options => Configuration.Bind("AzureAd", options));

services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
});

I can get claims through

var authState = await AuthenticationStateProvider.GetAuthenticationStateAsync();
var user = authState.User;

But how do I get an authentication token? I want it so that I can use it to authenticate with Microsoft Graph. I can't find anything in Azure AD besides the checkbox to include an auth token (which is checked). Any ideas?

EDIT with my changes to the accepted answer:

var scopes = new[] { "user.read" };
services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAd")
    .EnableTokenAcquisitionToCallDownstreamApi(scopes)
    .AddInMemoryTokenCaches();

services.AddDownstreamWebApiService(Configuration);
services.AddMicrosoftGraph(scopes, "https://graph.microsoft.com/v1.0");

services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
}).AddMicrosoftIdentityUI();

If you get the authentication token the way you want, please tell me? — buymeacoffee
– buymeacoffee, Commented Sep 2, 2020 at 3:17

buymeacoffee · Accepted Answer · 2020-09-02 03:16:38Z

3

You can use this demo project in github which with Azure AD Authentication, that calls the Microsoft Graph API on-behalf of the signed-in user.

public void ConfigureServices(IServiceCollection services)
{
    // replace this line
    //services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
    //.AddAzureAD(options => Configuration.Bind("AzureAd", options));

    // with this
    string[] scopes = Configuration.GetValue<string>("CalledApi:CalledApiScopes")?.Split(' ');
    services.AddMicrosoftWebAppAuthentication(Configuration, "AzureAd")
                .AddMicrosoftWebAppCallsWebApi(Configuration,
                                               scopes,
                                               "AzureAd")
            .AddInMemoryTokenCaches();
    services.AddDownstreamWebApiService(Configuration);
    services.AddMicrosoftGraph(scopes,
                               Configuration.GetValue<string>("CalledApi:CalledApiUrl"));


    // Added AddMicrosoftIdentityUI()
    services.AddControllersWithViews(options =>
    {
        var policy = new AuthorizationPolicyBuilder()
            .RequireAuthenticatedUser()
            .Build();
        options.Filters.Add(new AuthorizeFilter(policy));
    }).AddMicrosoftIdentityUI();

    services.AddRazorPages();
    // Add consent handler
    services.AddServerSideBlazor().AddMicrosoftIdentityConsentHandler();
        
    services.AddSingleton<WeatherForecastService>();
}

We can use Graph directly.

answered Sep 2, 2020 at 3:16

buymeacoffee

22.6k2 gold badges23 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

SamiHuutoniemi Over a year ago

Thank you! This actually works. But I did update it a bit because some methods there are obsolete. I'll put that in an EDIT of the question.

Mark Over a year ago

Thanks heaps! That demo project helped me find my missing configurations.

Collectives™ on Stack Overflow

Get authentication token with Blazor Server and Azure AD authentication

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related